From c4018d7baab23c9512f19c1ca72138c4d9e04d46 Mon Sep 17 00:00:00 2001 From: Carl Tashian Date: Thu, 21 May 2026 07:16:51 -0700 Subject: [PATCH] Apply ChromeOS cert-selection review feedback Address Herman's review on #513: - Use the Devices intermediate CA: on ChromeOS, certs come from the Devices authority, not Accounts. - Wrap the team slug placeholder in parentheses to match the actual generated CA common name (e.g., `Smallstep (acme) Devices Intermediate CA`). Co-Authored-By: Claude Opus 4.7 (1M context) --- tutorials/browser-certificate-setup-guide.mdx | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/tutorials/browser-certificate-setup-guide.mdx b/tutorials/browser-certificate-setup-guide.mdx index a59876bf..032a0c29 100644 --- a/tutorials/browser-certificate-setup-guide.mdx +++ b/tutorials/browser-certificate-setup-guide.mdx @@ -238,7 +238,7 @@ use the [`AutoSelectCertificateForUrls`](https://chromeenterprise.google/policie 4. Add an entry for each protected URL, in the following format: ```json - {"pattern":"[Server URL pattern]","filter":{"ISSUER":{"CN":"Smallstep [Team Slug] Accounts Intermediate CA"}}} + {"pattern":"[Server URL pattern]","filter":{"ISSUER":{"CN":"Smallstep ([Team Slug]) Devices Intermediate CA"}}} ``` Replace `[Server URL pattern]` with the server that requires certificate authentication. @@ -268,7 +268,7 @@ client certificate selection is configured per-network in the Google Workspace A 4. Set the **Issuer pattern** to the full common name of your Smallstep intermediate issuing CA: ``` - Smallstep [Team Slug] Accounts Intermediate CA + Smallstep ([Team Slug]) Devices Intermediate CA ``` Replace `[Team Slug]` with your Smallstep team slug.